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A quantum key distribution protocol based on quantum encryption is presented in this Brief 
Report. In this protocol, the previously shared Einstein- Podolsky- Rosen pairs act as the quantum 
key to encode and decode the classical cryptography key. The quantum key is reusable and the 
eavesdropper cannot elicit any information from the particle Alice sends to Bob. The concept of 
quantum encryption is also discussed. 
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' The aim of quantum information science is to use nonclassical features of quantum systems to achieve performance 
■ in communication and computation that is superior to that achievable with systems based solely on classical physics. 
For example, current methods of public-key cryptography base their security on the supposed (but unproven) com- 
putational difficulty in solving certain problems, such as finding the prime factors of large numbers - these problems 
have not only been unproven to be difficult, but have actually been shown to be computationally "easy" in the context 
of quantum computation In contrast, it is now generally accepted that techniques of quantum cryptography can 
allow completely secure communications between distant parties The problem that the proposed protocols solve 
is how to enable two protagonists, "Alice" and "Bob," who share no secret information initially, to transmit a secret 
\ message x, for example, a cryptographic key, under the nose of an adversary "Eve," who is free to eavesdrop on all 
^ i their communications. 

' In quantum key distribution (QKD), which is one of the important cryptographic tasks, Alice and Bob's classical 

• communication is supplemented by a quantum channel, which Eve is also free to eavesdrop on if she dares. Because of 
\ the fragile nature of quantum information, any eavesdropping disturbs the quantum transmission in a way likely to be 

• detected by Alice and Bob. The security of protocols for QKD such as the Bennett-Brassard 1984 (BB84) |] and the 
' Bennett 1992 protocol (B92) |^ is based on the premise that nonorthogonal states cannot be cloned or discriminated 
. exactly. Ekert's |^ and Cabello's protocols are based on the nonlocal correlation of Einstein-Podolsky- Rosen (EPR) 
' state. The orthogonal states' quantum QKD protocols are based on splitting transmission of one bit information into 

^pH, two steps 0. We categorize all the protocols mentioned above as source-encrypting QKD, for their methods are 
making an alternative choice on the basis of the source or splitting the source into two parts 0| . 

On the other hand, the nonlocal correlation of the EPR j|] state has been applied to do much work in quantum 
^ ' information field, such as quantum teleportation quantum dense coding p^ , QKD reducing the complexity 
of communication [ pl] |, etc. However, other applications of the EPR state in quantum information field are yet to be 
^ [ discovered. 

• 1^ . In this Brief Report, we present a QKD scheme using a method different from the protocols mentioned above. This 
' protocol is a quantum encryption, i.e., using the quantum key to encode and decode the classical information. And the 
^ : previously shared reusable EPR state acts as the quantum key. The information will not be leaked or eavesdropped 
■ " " without being known by the communication parties. We call it channel-encrypting QKD, compared with the previous 
protocols. 

The QKD process of this protocol consists of the following steps. Alice and Bob have previously shared some 
quantity of the EPR pairs serving as the quantum key 

|ci>+) = -i=(|00) + |ll)). (1) 

When the process begins, the two parties rotate their particle's state by angle 9, respectively. The rotation can be 
described as 

f cose siney 

^ ' \ ~smO cos ^ ' 
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The state 1$+) does not change under bilateral operation of R{9). The purpose of this operation is to prevent the 
other parties' from eavesdropping. (The detailed interpretation and the selection of 6 will be given later in this paper.) 
Then Alice selects a value of a bit (0 or 1) and prepares a carrier particle 7 in the corresponding state \^) (|0) or 
|1)) randomly. The classical bit and the state Itjj) are only known by Alice herself. Alice uses the particle /3a of the 
entangled pairs and 7 in state to do a controUed-NOT (CNOT) operation {Pa is the controller and 7 is the target) 
and the three particles will be in a GHZ state 

I*) = (1000) + 1111))^,^,^ , when jV') = |0) , (3) 

or I*) = ^ (1001) + 1110))^,^,^ , when |V) = |1) • 

Then she sends 7 to Bob. Bob uses his corresponding particle Pb to do a CNOT operation on 7 again. Now the key 
particles Pa and Pb and the carrier particle 7 are in the same state as the initial state 

|*') = |$+)®|V>). (4) 

Bob measures 7 and will get the classical bit corresponding to state \tp). 

To assess the secrecy of their communication, Alice and Bob select a random part of their bit string and compare 
it over the classical channel. Obviously, the disclosed bits cannot then be used for encryption anymore. If their key 
had been intercepted by an eavesdropper, the correlation between the values of their bits would have been reduced. 
Eve's eavesdropping strategies and the security of this protocol will be discussed later in this paper. 

If the QKD round succeeds, Alice and Bob retain all of the entangled states and can reuse them the next time. If 
the round fails, the parties discard all particles which were used until that point. In this case, Alice and Bob have to 
start again with new keys (EPR pairs). 

We now discuss the security of this protocol. First, Eve can intercept the particle Alice sends to Bob and then 
resend it or another particle to Bob. However, Eve cannot elicit any information from the particle she intercepted, 
because it is in the maximally mixed state 

P=^(|0)(0| + |1)(1|) (5) 

in spite of the bit value Alice sends out. If Eve sends this particle after disturbing it or sends another particle to Bob, 
it will introduce error when Bob decodes it by using the quantum key. If the state of the particle sent by Alice has 
been changed, the final state assumed is 

2 

Pi = j2pikmk){'^ik\, (6) 

k=l 

Kk) =a^fc|0) + 6^fe|l). 

The average error rate of the classical key Alice transmits to Bob will be 5. 

The second eavesdropping strategy is to entangle with the key. Eve can intercept the particle 7 Alice sends to Bob 
and use it and her own particle in state |0) or |1) to do a CNOT operation (her own particle is the target and 7 is 
the controller). Then Eve resends 7 to Bob. After Bob's decoding operation. Eve's particle is entangled with the 
key. It seems that Eve can use her particle to decode Alice's particle next time as Bob does. However, Eve cannot 
know in which state she is entangled with the key and cannot get any information of the state Alice sends to Bob. 
To detect this eavesdropping strategy, Alice and Bob can do a bilateral rotation R{0) on the key (EPR pairs in state 
1$+)) before Alice does the CNOT operation. The state of the maximally entangled two particles will be unchanged 
in this case. If Eve has entangled her particle with Alice and Bob's particles in the state \^)abe ~ (1*^0^) + |111)) 
[or \^)abe ~ (l^^-*-) IllO))]- second round, the entangled state will be changed to 

1$)^^^ =cos2^i=(|OOO) + |lll)) + sin2 0i=(|llO) + |OOl)) (7) 

+ sin6icos6'^ (|011) - |100)) + sin6»cos6'^ (|101) - |010)) 
V 2 V 2 

or 
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mABE = cos' (1001) + |110)) + Sin' 0l= (|111) + 1000)) (8) 

+ sin6icos6i^ (|010) - |101)) + sin6lcos6l^ (|100) - |011)) 
V 2 V 2 

under the bilateral rotation. The error rate of the bit that Alice sends to Bob will be 2cos^0sin'0. So if 9 = j, the 
error rate the eavesdropping caused will reach i. Thus the communication parties can select 9 — ^ a.s the bilateral 
rotation angle in every round and Eve cannot get any useful information of the bit string they transmit. 

Then we consider the more generic attacking. Assume that Eve can use her own system and the qubits sent by 
Alice to do a completely positive trace preserving map 

A (p) - E ^^P^^ ^itl^ E = ^ (9) 

i i 

on them, where / denotes the identity operator on the Hilbert space of the whole system's state. It is known |jl^ that 
the map is also of the form 

A{p) =Trc[Up(E)cuU'<] , (10) 

where a; is a state on the additional system C, and U is the unitary transformation on the joint system. So Eve's 
completely positive trace preserving map is equal to a unitary transformation on a larger system, and we can only 
consider the case in which Eve tries to obtain the information by unitary transformation on her own entire system 
and the qubit sent by Alice. 

Suppose that Eve's system has entangled with Alice and Bob's key in the state 

(|0) |0) l^Po) + |1) |1) \^i))abe ® |0)/ , (11) 

where \0) j is an indicator qubit for Eve to detect Alice's sending qubit and there is no restriction on the form of \^o) 
and \tpi). After Alice and Bob do a bilateral rotation R{9), Alice does a CNOT operation on the sending qubit and 
sends it out. Then Eve does a unitary transformation on the sending qubit and her own system. She expects that 
the indicator will be the same as the sending qubit. Assume that the unitary transformation has the universal form 

U \^)s \i^k)E - (ayfe |0) U^a^Jk) |0) + b,,k |0) l^b^jk) |1) (12) 
+Cijk |1) \ipcijk) |0) + dijk |1) \ipdijk) |l))s£;/, 

where i,j, fc = 0, 1 and there is no restriction on the final states of lip)^- 

If the attack strategy is successful, it requires that the output of the indictor qubit be the same as the sending 
qubit. However, when we compute the unitary transformation in Eq. (12) to satisfy this condition, we find that 
all the factors in Eq. (12) must be equal to 0. It means that the unitary transformation for a successful attacking 
strategy does not exist and the protocol is secure under this type of attack strategy. In fact. Eve's system and the 
sending qubit are in the reduced state 

p = \ (|0) (0| + |1) {l\)s ® (l^o) (V-ol + l^i) ® |0)/ (0| , (13) 

whether the qubit sent by Alice is |0) or |1). So Eve has no way to distinguish them and to obtain the qubit sent 
by Alice. Even if Eve adopts stronger strategics that would cause fewer errors and thus might be able to hide her 
presence in channel noise, she will obtain no information of the classical bit Alice sends to Bob, though she cannot 
be found. 

Up to this point, our discussion has assumed that the initial state is the ideal maximally entangled state | <&"''). 
Suppose, however, that this state is corrupted a little after it is reused for many times, due to nonexact operation or 
decoherence. Alice and Bob have a state described by the density matrix 

p=(l-e)|$+)($+|+epi, (14) 

where e is a parameter of the deviation of p from l*!"^) ('I'^l and pi is density matrix of an arbitrary state. Our results 
are most easily presented using the trace distance^ a metric on Hermitian operators defined by T {A, B) — Tr [\A ~ B\) 
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psf , where \X\ denotes the positive square root of the Hermitian matrix X"^. From the above, we can get that 
Ti\^+){^+\,p)<2V-e. 

Ruskai [T^ ] has shown that the trace distance contracts under physical processes. If all operations are exact in the 
next QKD process, since the state |$^) will be unchanged in the process, the density matrix p will be transformed to 

p' = (1 -£)!$+)($+ 1 (15) 

and r(|$+) < 2y^. 

The fidelities ^ F {\<^+) ($+1 ,p) and (*+| ,p') are both no less than 1 - e, so the probability that the 

QKD process fails is no more than e. Therefore, we can say that this protocol is robust. To prevent the degeneration 
of the entangled state, technologies of quantum privacy amplification p^ ] and entanglement purification can be 
used. These processes need only local quantum operation and classical communication (LQCC). However, the number 
of available entangled pairs will be reduced and need to be supplied by sending qubits. 

In the case where Alice sends particles in a noisy channel, the channel can be described by the Kraus operator jlj] 

p' = ^MtpM^, (16) 



Mq = -pi-p2 -Pal, Ml = y/p^ai,M2 = y^O-2,M3 = y^OS, (17) 

where / is the identity operator and ct^ are Pauli operators 

^=(o l)''^i = (l o)'^2 = (i "o^)'^3 = (o -i)- (1^) 

Since the original states Alice wants to send are orthogonal states in the basis {|0) , |1)}, after Bob's decoding and 
measurement, the error of the state will be projected to one of the three Pauli operators Ui, with probability pi, 
respectively. For error cti, the carrier bit is flipped and the EPR pair is not affected, for (T3, the carrier bit is not 
affected but the state of the EPR pair is changed from to I*!*") = (|00) — |11)), and for 0-2, the carrier bit 
is flipped and the EPR state is changed to |$~). As discussed later in this paper, we can conquer the bit flip by 
duplication code, And the corruption of the EPR pairs is the same as mentioned above. 

In this protocol, the previously shared EPR pairs act as a quantum key to encode and decode the classical cryp- 
tography key, and the quantum key is reusable. In classical cryptography, both the encryption key and the decoding 
key are random series, but they have a definite correlation. It is the randomness in the encryption key that makes the 
information secure and it is the correlation between the decoding key and the encryption key that makes the receiver 
able to extract the useful information from the cryptogram. Similar to the classical counterpart, in the quantum 
encryption we presented, from any party's point of view the quantum key is in a maximally mixed state. In fact, 
any single particle of the entangled pair is in a completely uncertain state. However, the states of the two parties' 
particles have strong quantum correlation, which is called entanglement, and have no classical counterpart. It is this 
correlation that makes the quantum encryption secure. Since this correlation cannot be produced by LQCC, the 
eavesdropper cannot establish this correlation with the sender. So the quantum key is reusable. In the classical case, 
the only crypto system that provides perfect secrecy is the "one time pad" system, in which the encryption key cannot 
be used repeatedly. The more interesting character of this QKD scheme is that, since the eavesdropper cannot elicit 
any information from the particle Alice sends to Bob, Alice can use classical error-correction code technology, such as 
duplication code, to conquer the bit flip error. 

From another point of view, this protocol can be regarded as a quantum channel encryption, i.e., a quantum key 
encrypts the quantum channel. In the QKD protocols presented before, the sender uses alternative choices of the 
basis of the source or sends out the qubit separately. In our protocol, the classical bit is represented by the normal 
orthogonal basis of the particle. If we regard the EPR pair as a part of the channel, the quantum channel is encrypted. 
The classical information source can be transmitted securely, without leaking, in this modified channel. 

In practice, the previously shared EPR pairs can be realized by standing qubits, such as entangled atoms, and the 
single photons can serve as the flying qubits sent out by Alice. The interaction of atom and photon can be realized 
by the technology of cavity quantum electrodynamics (CQED). The theoretical schemes of this technology have been 
proposed ||l^ and the research in laboratory has made some progress |l^ . So this protocol is expected to be realized 
in the laboratory in the near future. 
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In summary, we have presented the concept of quantum encryption and proposed a QKD scheme based on quantum 
encryption. This method has been used in quantum authentication [ pO[ and can be used for the encryption of arbitrary 
quantum states ||2l|] . 

This work was supported by the National Natural Science Foundation of China. 



P. W. Shor, in Proceedings of the 35th Annual Symposium on the Foundations of Computer Science, p. 124-133 (IEEE 
Computer Society Press, Los Alamitos, California, 1984). 
H.-K. Lo, H. F. Chau, Science 283, 2050 (1999). 

C. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computers, Systems, and Signal 
Processing, Bangalore, India, 1984 (IEEE, New York, 1984), p. 175. 
C. H. Bennett. Phys. Rev. Lett. 68, 3121 (1992). 
A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991). 



A. Cabello, Phys. Rev. A 61 052312 (2000); A. Cabello, arXiv; |quant-ph/0009051 . 

L. Goldenberg and L. Vaidman, Phys. Rev. Lett. 75, 1239 (1995); M. Koashi and N. Imoto, Phys. Rev. Lett. 79, 2383 

(1997); T. Mor, Phys. Rev. Lett. 80, 3137 (1998). 

A. Einstein, B. Podolsky and N. Rosen, Phys. Rev. 47, 777 (1935). 

H. Bennett, G. Brassard, C. Crepeau, R. Jozsa, A. Peres and W. K. Wootters, Phys. Rev. Lett. 70, 1895 (1993). 
H. Bennett and S. J. Wiesner, Phys. Rev. Lett. 69, 2881 (1992). 
Cleve and H. Buhrman, Phys. Rev. A 56, 1201 (1997). 



Kraus, States, Effects and Operations: Fundamental Notions of Quantum Theory (Wiley, New York, 1991). 
Vidal, D. Jonathan and M. A. Nielsen, Phys. Rev. A 62, 012304 (2000). 
B. Ruskai, Rev. Math. Phys. 6, 1147 (1994). 
Jozsa, J. Mod. Opt. 41, 2315 (1994). 

Deutsch, A. Ekert, R. Jozsa, C. Macchiavello, S. Popescu and A. Sanpera, Phys. Rev. Lett. 77, 2818 (1996). 
H. Bennett, G. Brassard, S. Popescu, B. Schumacher, J. A. Smolin and W. K. Wootters, Phys. Rev. Lett. 76, 722 
(1996). 

T. Sleator and H. Weinfurter, Phys. Rev. Lett. 74, 4087 (1995). 

H. Mabuchi, Q. A. Turchette, M. S. Chapman and H. J. Kimble, Opt. Lett. 21, 1393 (1996); S. Haroche, M. Brune and 
J. M. Raimond, Phil. Trans. R. Soc. Lond. A 355, 2367 (1997). 
Y.-S. Zhang, C.-F. L i and G.-C. Guo, a rXiv: |:iuant-ph/0008044 , 
D. W. Leung arXiv: |quant-ph/0012077|. 



5 



